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Abstract 

We study quantum key distribution with Standard weak coherent states and show, 
rather counter-intuitively, that the detection events originated from vacua can contribute 
to secure key generation rate, over and above the best prior art result. Our proof is based 
on a communication complexity /quantum memory argument. 



1 Introduction 

The best-known application of quantum cryptography is quantum key distribution (QKD) 
0. The goal of QKD is to allow two parties, Alice and Bob, to share a common string 
of secret in the presence of an eavesdropper, Eve. Such a key can subsequently be used 
for, for example, perfectly secure Communications via the so-called one-time-pad. Unlike 
conventional cryptography, the security of QKD is guaranteed by the fundamental law 
of physics — the Heisenberg uncertainty principle. The best-known protocol for QKD 
is the Bennett-Brassard protocol (BB84) 0. In BB84, Alice sends Bob a sequence of 
single photons in one of the four polarizations (vertical, horizontal, 45-degree and 135- 
degree) and Bob randomly performs a measurement in one of the two conjugate bases. In 
principle, the security of QKD has been proven in a number of papers including 

For practical implementations, an attenuated làser pulse (a so-called weak coherent 
state) is often used as the source. The security of QKD with a rather genèric class of 
imperfect devices has been proven in GLLP j5; , following the earlier work [üj Recently, 
Hwang [7] has proposed a decoy state idea for improving the performance (i.e., the key 
generation rate and distance) of QKD systems. We |S] have demonstrated rigorously 
how the decoy state idea can be combined with GLLP to obtain a key generation rate 
(per pulse emitted by Alice) which is lower bounded by: 

S > QM g uai{-H 2 (E 3Ígna i) + íl 1 [l-H 2 (ei)]}, (1) 

where Q S i gn ai and E s i grí ai are respectively the gain and quantum bit error rate (QBER) 
of the signal state, Qi and ei are respectively the fraction and QBER of detection events 
by Bob that have originated from single-photon signals emitted by Alice. Here, the gain 
means the ratio of Bob's detection events to Alice's total number of emitted signals. 
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[Decoy state QKD has subsequently been investigated by Wang 9 and by Harrington 

M-] 

The key goal of this paper is to increase the above key generation rate in Eq. Qby a 
term Q a i ana i^lo where íío is the fraction of detection events of Bob that have originated 
from vacua emitted by Alice. More concretely, we have the following main Theorem. 

Theorem 1 The key generation of an efficient BB84 scheme is given by: 

S > Q sl3 nai{-H 2 (E slgna i) +n + fii[l - H 2 (ei)]}, (2) 

where fio is the fraction of detection events by Bob that has originated from the vacuum 
signals emitted by Alice. In other words, we find that each detection event by Bob that 
has originated from a vacuum (i.e., nothing) emitted by Alice automatically contributes 
to a bit of secure key over and above the prior art result (Eq.0 presented in |ü] and also 
0. 

Before we embark on a detailed discussion, let us check for the consistency of our 
result. Naively, one might think that our suggestion that the vacuum will contribute to 
a secure key is an insane idea because if nothing is emitted by Alice, what is the origin of 
security? We remark that the vacuum alone does not contribute to a secure key. More 
concretely, suppose all the signals sent by Alice are vacua and there are no background 
events. Then, ÍÍq = 1, íïi = 0, and E S i gna i = 1/2. Therefore, from Eq. [5] we get the 
lower bound for the key generation rate. The reason is that the term fio is exactly 
cancelled by the error correction term —H2(E s i gna i). 

What Eq.|Udoes say is that no privacy amplification is needed for the vacua state. 
This is intuitively clear because Eve cannot have any a priori information on Alice's bit, 
if nothing is emitted from Alice's laboratory. 

Now, let us prové our main result (Eq.|5J. We shall use the method of communication 
complexity. As noted by by Ben-Or [3| and by Renner and Koenig [111 . the number of 
rounds of universal hashing needed for privacy amplification in QKD is at most given by 
any upper bound to the size of Eve's quantum memory which contains information on 
the key. In other words, we have, informally: 

Theorem 2 [3*1 lll|: The key generation rate in QKD 

S > N - S E ve (3) 

where N is the size of the sifted key shared between Alice and Bob and SEve is the size 
of Eve's quantum memory. [A more formal definition involving the relevant e and 5 can 
be found as Eq. (11) in [TT).l 

Remark Note that Theorem 2 only gives a lower bound to the key generation rate 
because it does not consider the possibility of advantage distillation in QKD I12| . 

In summary, all we need to compute (a lower bound to) the key generation rate is to 
work out the size of Eve's quantum memory. 

Proof of Theorem 1: Now, note that Eve has two pieces of information on the 
key. The first piece, which is strictly quantum, comes from Eve's eavesdropping attack 
during the quantum transmission from Alice to Bob. The second piece is classical and 
comes from the classical error correction part. 

We argue that the first piece, from eavesdropping the quantum transmission, consists 
of two parts: single-photon part and multi-photon part. It should be emphasized that the 
vacua signals do not contribute at all. This is because, since Alice is emitting nothing, 
Eve cannot possibly learn anything about Alice's key. Eve can influence and, in fact, 
decide on Bob's key by sending her own photons into Bob's detector. However, Bob's 
key does not really teli Eve anything about Alice's key. 

Let us consider the multi-photon part first. We take the most conservative assumption 
that Eve has all the information on all multi-photon signals. Her quantum memory 
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size on the multi-photon part is trien given by QsignaiQm ■ Here, fi m is the fraction 
of detection events of Bob that have originated from multi-photon signals. Note that 
fio + fii + fi m = 1. The single-photon part is given by simply Q a i g nai^íiH2(e^ hase ), where 
e\ aBe is the phase error rate of the single-photon signals. From Shor-PreskilPs proof 
e phase _ ei ^ wn ; cn j s ^jjg bit-flip error rate for the single-photon signals. So, the quantum 
memory for single-photon part is actually given by Qsignai^iH^iei). Adding the two 
parts, the first piece of Eve's information has a memory size Qsignai[^iH2(ei) + fi m ]. 
The second piece of Eve's information, which comes from classical error correction, is 
asymptotically given by Q S i gn aiH 2 {E signa i). 

In summary, adding the two pieces together, the total quantum memory size of Eve 

ÍS given by Ssve = Qsignal{H2{E signa l) + fiiíf 2 (ei) + fim]- 

Now, the length of the sifted key (per pulse emitted by Alice) shared by Alice and 
Bob is N = Q signal [fio + fií + fim] • Therefore, the number of secure key bits (per pulse 
emitted by Alice) is given by 

S > N - S E ve 

= Qs l gnal{-H 2 {E slgnal )+Q. + Q. 1 [l- H 2 {e!)]}. (4) 

which is precisely Eq. This concludes the proof of our Theorem 1. 

In summary, we have increased the key generation from Eq. Q in the prior art result 
to Eq. by showing that, rather counter-intuitively, the detection events due to 
vacua contribute directly to the secure key. What is interesting about this result is that 
it is based on a communication complexity approach and is not entirely clear whether 
it can be derived from an entanglement distillation approach. In future, it will perhaps 
be interesting to rephrase this result in the general framework of P states |13|. which 
generalizes the entanglement distillation approach. 
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